nerdexam
CompTIA

CAS-002 · Question #886

An educational institution would like to make computer labs available to remote students. The labs are used for various IT networking, security, and programming courses. The requirements are: 1…

The correct answer is C. IPSec VPN with mutual authentication for remote connectivity, RADIUS for authentication, ACLs. IPSec VPN with mutual certificate authentication, RADIUS, and ACLs is the only option that collectively satisfies all six requirements including mutual certificate trust, a single VPN profile, and per-lab network segmentation.

Technical Integration of Enterprise Components

Question

An educational institution would like to make computer labs available to remote students. The labs are used for various IT networking, security, and programming courses. The requirements are: 1. Each lab must be on a separate network segment. 2. Labs must have access to the Internet, but not other lab networks. 3. Student devices must have network access, not simple access to hosts on the lab networks. 4. Students must have a private certificate installed before gaining access. 5. Servers must have a private certificate installed locally to provide assurance to the students. 6. All students must use the same VPN connection profile. Which of the following components should be used to achieve the design in conjunction with directory services?

Options

  • AL2TP VPN over TLS for remote connectivity, SAML for federated authentication, firewalls
  • BSSL VPN for remote connectivity, directory services groups for each lab group, ACLs on routing
  • CIPSec VPN with mutual authentication for remote connectivity, RADIUS for authentication, ACLs
  • DCloud service remote access tool for remote connectivity, OAuth for authentication, ACL on

How the community answered

(47 responses)
  • A
    6% (3)
  • B
    13% (6)
  • C
    60% (28)
  • D
    21% (10)

Why each option

IPSec VPN with mutual certificate authentication, RADIUS, and ACLs is the only option that collectively satisfies all six requirements including mutual certificate trust, a single VPN profile, and per-lab network segmentation.

AL2TP VPN over TLS for remote connectivity, SAML for federated authentication, firewalls

SAML is a web-based federated authentication protocol and does not support the client-side private certificate installation required for network-level VPN mutual authentication described in requirements 4 and 5.

BSSL VPN for remote connectivity, directory services groups for each lab group, ACLs on routing

SSL VPN does not inherently enforce mutual certificate authentication, and assigning directory services groups per lab contradicts requirement 6, which mandates a single shared VPN connection profile for all students.

CIPSec VPN with mutual authentication for remote connectivity, RADIUS for authentication, ACLsCorrect

IPSec VPN with mutual authentication satisfies requirements 4 and 5 by requiring both the student device and the server to present private certificates, establishing bidirectional trust. RADIUS integrates with directory services to enforce centralized authentication while supporting a single shared VPN connection profile for all students (requirement 6), and ACLs on routing enforce per-lab network segmentation and block cross-lab traffic while permitting Internet access (requirements 1 and 2).

DCloud service remote access tool for remote connectivity, OAuth for authentication, ACL on

Cloud remote access tools with OAuth do not support installing private certificates on student devices or servers as required by requirements 4 and 5, and OAuth is an authorization delegation framework unsuitable for network-layer VPN access control.

Concept tested: IPSec VPN mutual certificate authentication with RADIUS and ACL segmentation

Source: https://learn.microsoft.com/en-us/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-ras

Topics

#IPSec VPN#mutual authentication#RADIUS#network segmentation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice